As far as I know, you can buy almost all hardware wallets directly from the manufacturer.  But then, you are placing your trust in the manufacturer. I dont see that as a big difference from trusting a big retailer. You have to believe they are not shipping a device with a hidden backdoor they can exploit later. This is an especially big risk for wallets that are not fully open source. (The Ledger "recovery" fiasco proved this point: a supposedly secure device was found to have a hidden feature that could compromise your private keys.)